Running sbx sandboxes

Docker Sandboxes (sbx) runs AI coding agents inside isolated microVMs. Each sandbox gets its own Linux kernel, its own Docker Engine, its own network, and a host-side proxy that enforces network policy and injects credentials so secrets never enter the VM.

This is the operating surface — running sandboxes, choosing and configuring the built-in agents, controlling egress, and wiring credentials. Seven sibling skills carry the rest: